I was cleaning up several Azure resource groups that I had created for personal projects. I assumed the portal was only showing groups I owned, so I deleted several without checking each one carefully. Just before deleting another, I noticed resources that clearly did not belong to me and realized I had access to other people's resource groups. Unfortunately, I had already deleted one belonging to the company.
I don't know whether the resource group contained anything important or whether the company has backups. I tried to submit a high-severity support ticket, but I don't have permission to do so. I also reviewed roughly three months of activity-log data, though the available details haven't clarified what was inside the deleted group. The company has around 10,000 employees, and I work in a completely nontechnical role, so I'm not sure who owns the subscription or how to escalate this properly.
Is there a way to determine what resources were deleted or recover information about the resource group? What should I do immediately, and who should I notify? Would a large company normally have safeguards such as role restrictions, resource locks, backups, or infrastructure-as-code definitions that could help restore it?
5 Answers
Tell your manager or supervisor immediately and explain exactly what happened. If you don't know who manages Azure, contact the help desk and ask them to identify the subscription owner, cloud team, or incident-response contact. You don't need to diagnose or restore anything yourself; your priority is to report the incident quickly and accurately.
The company may be able to rebuild the environment from backups, deployment templates, Bicep, Terraform, or other source-controlled definitions. Some individual services also have their own backup and recovery options. However, don't assume that a large company automatically has a working recovery plan—report it as a potentially serious incident and let the responsible technical team determine the impact.
This was a mistake on your part, but the permissions were also configured poorly. A nontechnical employee generally shouldn't have permission to delete arbitrary resource groups. Proper role-based access control, narrowly scoped permissions, deletion locks, approval workflows, and separate production access would reduce the chance of this happening.
Exactly. Even if the deletion turns out to have affected only unused resources, the organization should review why the account had that level of access and whether delete protection was enabled.
Stop making changes in Azure for now. Write down the resource group name, subscription information, approximate deletion time, and anything else you remember. The activity log may confirm the deletion operation and identity, but it usually won't provide a complete inventory of everything that was inside a deleted resource group. The cloud administrators or the provider's support team may be able to investigate further.
Own the mistake, be factual, and don't try to hide or independently repair anything. Give your supervisor or incident team the exact timeline and operation details, then wait for instructions. It may turn out to be harmless cleanup or it may require restoration, but the fastest way to limit damage is prompt escalation rather than more investigation with elevated access.
I tried submitting a high-severity ticket but apparently don't have the permissions. I'll escalate through my manager and the help desk instead.